#!/usr/bin/env bash
set -euo pipefail
BASE_URL="${BASE_URL:?Set BASE_URL, for example https://staging.example.pl}"
headers="$(curl -sS -I "$BASE_URL/login.php")"
for header in strict-transport-security content-security-policy x-content-type-options referrer-policy permissions-policy; do
  if ! grep -qi "^${header}:" <<<"$headers"; then
    echo "MISSING: $header" >&2
    exit 1
  fi
done
if grep -qi '^server:.*PHP' <<<"$headers"; then
  echo "WARNING: server header reveals PHP" >&2
fi
echo "PASS: baseline security headers present"